Remote system, remote connection method and computer readable storage medium

Abstract

In a remote system, a local area network including a production device and a gateway device is connected to a server device via a wide area network. The remote system includes a network device that permits connection from an inside to an outside of the local area network and rejects connection from the outside to the inside. The gateway device requests the server device to establish a first session between the gateway device and the server device. The server device compares device identification information for identifying a target production device designated by the external terminal with device identification information set to the production device, establishes the first session in response to a request for establishment of the first session, establishes a second session between the server device and the external terminal when both of pieces of the device identification information matches, and links the first session and the second session.

The invention claimed is: 
     
         1 . A remote system for implementing remote connection to a production device by an external terminal, the remote system comprising:
 a gateway;   a server device to relay communication between the production device and the external terminal via a local area network including the production device and the gateway, the local area network and the server device being connected via a wide area network, the server device being situated outside of the local area network, the external terminal being an information communication device; and   a network device situated between the gateway and the server device, the network device to permit connection from an inside of the local area network to an outside of the local area network and reject all connection from the outside of the local area network to the inside of the local area network, the network device being installed at (a) a connection point of the local area network and the wide area network or (b) between (i) the connection point and (ii) the production device, wherein   the gateway requests the server device to establish a first session between the gateway and the server device, and   the server device:
 stores device information in which device identification information for identifying the production device is associated with gateway identification information for identifying the gateway connectable to the production device; 
 compares, when receiving a device connection request including device identification information for identifying a target production device from the external terminal, the device identification information in the device connection request with the device identification information for identifying the production device; 
 establishes the first session in response to a request for establishment of the first session; 
 establishes a second session between the external terminal and the server device when the device identification information of the target production device is included in the device information as a result of the comparison; 
 acquires, from the device information, the gateway identification information corresponding to the device identification information in the device connection request, the first session being established between the server device and the gateway that corresponds to the acquired gateway identification information; 
 links the first session and the second session; and 
 relays the communication between the external terminal and the production device by using the first session and the second session that are linked with each other. 
   
     
     
         2 . The remote system according to  claim 1 , wherein
 the gateway further searches for the production device connected to the local area network and requests the production device to transmit the device identification information, and   the gateway registers the device identification information in the server device when receiving the device identification information from the production device.   
     
     
         3 . The remote system according to  claim 2 , wherein the device identification information of the production device is registered in the production device by the external terminal. 
     
     
         4 . The remote system according to  claim 2 , wherein the production device has a function of generating the device identification information. 
     
     
         5 . The remote system according to  claim 1 , wherein
 the gateway further searches for the production device connected to the local area network and generates the device identification information of the production device, and   the gateway registers the device identification information in the server device when generating the device identification information.   
     
     
         6 . The remote system according to  claim 1 , wherein the server device further:
 stores gateway information for authenticating the gateway;   compares the gateway information with gateway authentication information for authenticating the gateway, the gateway authentication information being transmitted from the gateway; and   permits establishment of the first session between the server device and the gateway when the gateway is an authorized gateway as a result of the comparison.   
     
     
         7 . The remote system according to  claim 1 , wherein the server device further:
 stores user information for authenticating a user of the external terminal;   compares the user information with user authentication information for authenticating the user, the user authentication information being transmitted from the external terminal; and   permits access by the external terminal to the production device when the user is an authorized user as a result of comparison.   
     
     
         8 . The remote system according to  claim 7 , wherein the server device further:
 stores access control information in which access authority to the production device and the gateway is set for each user, and   determines extent accessible by the user with reference to the access control information.   
     
     
         9 . The remote system according to  claim 1 , further comprising one or more of a firewall, an unauthorized intrusion detection system to detect unauthorized communication, an unauthorized intrusion prevention system to block unauthorized communication, and a web application firewall to protect a web application from an attack that abuses vulnerability of the web application. 
     
     
         10 . The remote system according to  claim 9 , wherein the one or more of the firewall, the unauthorized intrusion detection system to detect the unauthorized communication, the unauthorized intrusion prevention system to block the unauthorized communication, and the web application firewall to protect the web application from the attack that abuses vulnerability of the web application is situated between the network device and the gateway. 
     
     
         11 . The remote system according to  claim 1 , wherein the gateway is the production device having a function of gateway. 
     
     
         12 . The remote system according to  claim 1 , wherein
 a plurality of the local area network is provided, and   gateways of the plurality of the local area networks each corresponding to the gateway are connected to one another.   
     
     
         13 . The remote system according to  claim 1 , wherein the network device includes a firewall that permits connection from the inside of the local area network to the outside of the local area network and rejects all connection from the outside of the local area network to the inside of the local area network. 
     
     
         14 . A remote connection method for implementing remote connection to a production device by an external terminal, the method comprising:
 relaying, by a server device, communication between the production device and the external terminal via a local area network including the production device and a gateway, the local area network and the server device being connected via a wide area network, the server device being situated outside of the local area network, the external terminal being an information communication device;   permitting connection from an inside of the local area network to an outside of the local area network and rejecting all connection from the outside of the local area network to the inside of the local area network, by a network device situated between the gateway and the server device and installed at (a) a connection point of the local area network and the wide area network or (b) between (i) the connection point and (ii) the production device;   requesting, by the gateway, the server device to establish a first session between the gateway and the server device;   establishing, by the server device the first session in response to a request for establishing the first session;   checking, by the server device, whether device identification information included in a device connection request is included in device information when the server device receives, from the external terminal, the device connection request including the device identification information for identifying a target production device designated from the external terminal, wherein the device identification information for identifying the production device is associated with gateway identification information for identifying the gateway connectable to the production device in the device information;   establishing, by the server device, a second session between the external terminal and the server device when the device identification information included in the device connection request is included in the device information as a result of the checking;   acquiring, by the server device, from the device information, the gateway identification information corresponding to the device identification information included in the device connection request;   linking, by the server device the first session and the second session; and   relaying, by the server device, the communication between the external terminal and the production device by using the first session and the second session that are linked with each other.   
     
     
         15 . A non-transitory computer readable storage medium storing a program for operating a server device to be used in a remote system that implements remote connection to a production device by an external terminal, the program causing the server device to execute:
 relaying, by a server device, communication between the production device and the external terminal via a local area network including the production device and a gateway, the local area network and the server device being connected via a wide area network, the server device being situated outside of the local area network, the external terminal being an information communication device;   storing device information in which identification information for identifying the production device is associated with gateway identification information for identifying the gateway connectable to the production device;   receiving, from the external terminal, a device connection request including device identification information for identifying a target production device designated from the external terminal;   checking whether the device identification information included in the device connection request is included in the device information;   establishing a first session in response to a request, from the gateway, for establishing the first session between the gateway and the server device, the request for establishing the first session being received via a network device situated between the gateway and the server device and installed at (a) a connection point of the local area network and the wide area network or (b) between (i) the connection point and (ii) the production device, the network device permitting connection from an inside of the local area network to an outside of the local area network and rejecting all connection from the outside of the local area network to the inside of the local area network;   establishing a second session between the external terminal and the server device when the device identification information included in the device connection request is included in the device information as a result of the checking;   acquiring, from the device information, the gateway identification information corresponding to the device identification information included in the device connection request;   linking the first session and the second session, the first session being established between the server device and the gateway that corresponds to the acquired gateway identification information; and   relaying communication between the external terminal and the production device by using the first session and the second session that are linked with each other.